@reventlessdev/reventless-aws 3.0.0-alpha.248 → 3.0.0-alpha.249

package/CHANGELOG.md

@@ -3,6 +3,14 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.249 (2026-07-31)
+
+**Note:** Version bump only for package @reventlessdev/reventless-aws
+
+
+
+
+
 # 3.0.0-alpha.248 (2026-07-30)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.248",
+  "version": "3.0.0-alpha.249",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -11,17 +11,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.25",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.9",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.31",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.17",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.61",
-    "@reventlessdev/rescript-uuid": "1.1.0-alpha.17",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.195",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.113",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.88",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.29",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.59"
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.0",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.0",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.62",
+    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.196",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.114",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.89",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.60"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/rescript.json

@@ -23,6 +23,7 @@
   ],
   "dependencies": [
     "sury",
+    "@reventlessdev/rescript-node",
     "@reventlessdev/rescript-jest",
     "@reventlessdev/rescript-aws-sdk",
     "@reventlessdev/rescript-effect",

package/src/adapter/Api/AppSyncEventsSigner_Ops.res

@@ -11,44 +11,26 @@
 // AppSyncEventsSigner_ParityFixture.mjs pins that original as a golden reference
 // and AppSyncEventsSigner_OpsTest asserts byte-for-byte equality.
 
-// ── node:crypto (string- and buffer-keyed HMAC; the signing key chain feeds a
-//    Buffer digest back in as the next key) ──────────────────────────────────
+let sha256hex = (data: string): string =>
+  NodeCrypto.createHash("sha256")->NodeCrypto.hashUpdate(data)->NodeCrypto.hashDigest("hex")
 
-type buffer
-
-type hmac
-@module("node:crypto") external createHmacStr: (string, string) => hmac = "createHmac"
-@module("node:crypto") external createHmacBuf: (string, buffer) => hmac = "createHmac"
-@send external hmacUpdate: (hmac, string) => hmac = "update"
-@send external hmacDigestBuf: hmac => buffer = "digest"
-@send external hmacDigestHex: (hmac, string) => string = "digest"
-
-type hash
-@module("node:crypto") external createHash: string => hash = "createHash"
-@send external hashUpdate: (hash, string) => hash = "update"
-@send external hashDigestHex: (hash, string) => string = "digest"
-
-let sha256hex = (data: string): string => createHash("sha256")->hashUpdate(data)->hashDigestHex("hex")
-
-let hmacFromStr = (key: string, data: string): buffer =>
-  createHmacStr("sha256", key)->hmacUpdate(data)->hmacDigestBuf
-let hmacFromBuf = (key: buffer, data: string): buffer =>
-  createHmacBuf("sha256", key)->hmacUpdate(data)->hmacDigestBuf
+let hmacFromStr = (key: string, data: string): NodeCrypto.buffer =>
+  NodeCrypto.createHmac("sha256", key)->NodeCrypto.hmacUpdate(data)->NodeCrypto.hmacDigestBuffer
+let hmacFromBuf = (key: NodeCrypto.buffer, data: string): NodeCrypto.buffer =>
+  NodeCrypto.createHmacFromBuffer("sha256", key)->NodeCrypto.hmacUpdate(data)->NodeCrypto.hmacDigestBuffer
 
 // ── SigV4 ───────────────────────────────────────────────────────────────────
 
 type creds = {accessKeyId: string, secretAccessKey: string, sessionToken: option<string>}
 
-@val @scope("process") external processEnv: dict<string> = "env"
-
 // Ambient Lambda execution-role credentials (the managed runtime injects these).
 let envCreds = (): creds => {
-  accessKeyId: processEnv->Dict.get("AWS_ACCESS_KEY_ID")->Option.getOr(""),
-  secretAccessKey: processEnv->Dict.get("AWS_SECRET_ACCESS_KEY")->Option.getOr(""),
-  sessionToken: processEnv->Dict.get("AWS_SESSION_TOKEN"),
+  accessKeyId: NodeProcess.env->Dict.get("AWS_ACCESS_KEY_ID")->Option.getOr(""),
+  secretAccessKey: NodeProcess.env->Dict.get("AWS_SECRET_ACCESS_KEY")->Option.getOr(""),
+  sessionToken: NodeProcess.env->Dict.get("AWS_SESSION_TOKEN"),
 }
 
-let region = (): string => processEnv->Dict.get("AWS_REGION")->Option.getOr("eu-west-1")
+let region = (): string => NodeProcess.env->Dict.get("AWS_REGION")->Option.getOr("eu-west-1")
 
 // Sign a `POST <path>` for service `appsync`. `isoNow` is a Date().toISOString()
 // string, taken as an argument so the signer is pure and parity-testable. The
@@ -89,7 +71,7 @@ let signedHeaders = (
   let kRegion = hmacFromBuf(kDate, region)
   let kService = hmacFromBuf(kRegion, "appsync")
   let kSigning = hmacFromBuf(kService, "aws4_request")
-  let signature = createHmacBuf("sha256", kSigning)->hmacUpdate(stringToSign)->hmacDigestHex("hex")
+  let signature = NodeCrypto.createHmacFromBuffer("sha256", kSigning)->NodeCrypto.hmacUpdate(stringToSign)->NodeCrypto.hmacDigest("hex")
 
   let authorization = `AWS4-HMAC-SHA256 Credential=${creds.accessKeyId}/${scope}, SignedHeaders=${signedHeaderList}, Signature=${signature}`
   let out = Dict.fromArray(sorted)

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res

@@ -12,7 +12,6 @@
 // sury-encoded with the same shape as the in-memory adapter's
 // encodePluginStructureEntry, so it is wrapped with `pluginId` without decoding.
 
-@val @scope("process") external processEnv: dict<string> = "env"
 
 let str = (item: dict<JSON.t>, key: string): option<string> =>
   item->Dict.get(key)->Option.flatMap(JSON.Decode.string)
@@ -61,14 +60,14 @@ let toEntry = (item: dict<JSON.t>, ~name: string): option<JSON.t> =>
 // ADMIN_ENTRY_JSON env var (the admin never Connects to itself, so its structure
 // never enters the Plugin read model).
 let adminEntry: option<JSON.t> =
-  switch processEnv->Dict.get("ADMIN_ENTRY_JSON") {
+  switch NodeProcess.env->Dict.get("ADMIN_ENTRY_JSON") {
   | Some(s) if s != "" => Some(JSON.parseOrThrow(s))
   | _ => None
   }
 
 let handler = async (_event: JSON.t): array<JSON.t> => {
   let admin = adminEntry->Option.mapOr([], e => [e])
-  switch processEnv->Dict.get("PLUGIN_RM_TABLE") {
+  switch NodeProcess.env->Dict.get("PLUGIN_RM_TABLE") {
   | None | Some("") =>
     Console.error("Platform_ComponentDefinitions: PLUGIN_RM_TABLE env var not set")
     admin

package/src/adapter/Api/Platform_UIFragments_Lambda_Ops.res

@@ -11,7 +11,6 @@
 // adapter's Platform_UIFragmentsApi.encodeUIFragmentEntry produces, so rows are
 // returned as-is (bar the name/version collapse).
 
-@val @scope("process") external processEnv: dict<string> = "env"
 
 let str = (item: dict<JSON.t>, key: string): option<string> =>
   item->Dict.get(key)->Option.flatMap(JSON.Decode.string)
@@ -38,7 +37,7 @@ let toEntry = (item: dict<JSON.t>, ~name: string): option<JSON.t> =>
   }
 
 let handler = async (_event: JSON.t): array<JSON.t> =>
-  switch processEnv->Dict.get("UI_FRAGMENT_RM_TABLE") {
+  switch NodeProcess.env->Dict.get("UI_FRAGMENT_RM_TABLE") {
   | None | Some("") =>
     Console.error("Platform_UIFragments: UI_FRAGMENT_RM_TABLE env var not set")
     []

package/src/adapter/EventLogSubscription/EventLogSubscription_AppSync_Ops.res

@@ -7,11 +7,10 @@
 // body, wraps it as a `{position, eventType, payload}` event, and publishes it
 // to the fixed plugin event-log channel on the AppSync Events API.
 
-@val @scope("process") external processEnv: dict<string> = "env"
 
 // Baked at deploy time: the normalised channel segment for this event log.
-let channel = "/default/" ++ processEnv->Dict.get("EVENT_LOG_CHANNEL")->Option.getOr("")
-let endpoint = processEnv->Dict.get("APPSYNC_ENDPOINT")->Option.getOr("")
+let channel = "/default/" ++ NodeProcess.env->Dict.get("EVENT_LOG_CHANNEL")->Option.getOr("")
+let endpoint = NodeProcess.env->Dict.get("APPSYNC_ENDPOINT")->Option.getOr("")
 
 // SQS Lambda event (only the fields this handler reads).
 type sqsRecord = {body: string, messageId: string}

package/src/adapter/Geocoder/Geocoder_AwsLocation_Ops.res

@@ -39,11 +39,10 @@ external makeSearchPlaceIndexForTextCommand: searchPlaceIndexForTextInput => sea
 
 // ── Node bindings (replacing the former `%raw` env helper with a typed one) ──
 
-@val @scope("process") external processEnv: dict<string> = "env"
 
 // Read an env var, mapping "" / unset to None.
 let getEnv = (k: string): option<string> =>
-  switch processEnv->Dict.get(k) {
+  switch NodeProcess.env->Dict.get(k) {
   | Some("") | None => None
   | Some(v) => Some(v)
   }

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res

@@ -20,7 +20,6 @@
 // `callback.phase1`. The `bodyModule` and `context` HANDLER_CONFIG fields
 // exist for this wiring (AutomationSliceRuntime_Builder_Single).
 
-@val @scope("process") external processEnv: dict<string> = "env"
 
 type handlerEntry = {
   specModule: string,
@@ -81,7 +80,7 @@ let warnMissingBodyModule = (entry: handlerEntry) =>
 // Fallback for automation entries from a config without `context` — sliceName
 // is the only field the runtime can still recover.
 let defaultContext = (sliceName: string): Reventless.AutomationSlice.context => {
-  environment: processEnv->Dict.get("Environment")->Option.getOr("unknown"),
+  environment: NodeProcess.env->Dict.get("Environment")->Option.getOr("unknown"),
   platformName: "unknown",
   pluginName: "unknown",
   sliceName,

package/src/adapter/Runtime/EventCollectorEntryPoint_Ops.res

@@ -58,7 +58,6 @@ external scanByTableName: (
   int,
 ) => promise<array<JSON.t>> = "scanByTableName"
 
-@val @scope("process") external processEnv: dict<string> = "env"
 
 let exnMessage = (exn: exn): string =>
   exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown error")
@@ -536,7 +535,7 @@ let reconcileSubscriptionsOnce = async (
 // rule prefix must be stable across deploys and unique per stack;
 // AWS_LAMBDA_FUNCTION_NAME carries a content hash. PluginExtensionPointEntryPoint
 // instantiates the same admin EP module and must derive this identically.
-let environment = processEnv->Dict.get("Environment")->Option.getOr("unknown")
+let environment = NodeProcess.env->Dict.get("Environment")->Option.getOr("unknown")
 
 // Only what the admin EP mapping's callHandler needs: sendMessageToChannel for
 // ForwardCommand.
@@ -613,7 +612,7 @@ let buildPublishToAggregates = (map: dict<string>): dict<ReventlessCore.CommandT
   ->Dict.toArray
   ->Array.map(((aggName, envVarName)) => (
     aggName,
-    makePublishJsons(processEnv->Dict.get(envVarName)->Option.getOr("")),
+    makePublishJsons(NodeProcess.env->Dict.get(envVarName)->Option.getOr("")),
   ))
   ->Dict.fromArray
 
@@ -632,7 +631,7 @@ let extensionPublishDicts = (config: handlerConfig, ext: extensionConfig): exten
     ->Array.filterMap(name =>
       envVarNames
       ->Dict.get(name)
-      ->Option.flatMap(envVarName => processEnv->Dict.get(envVarName))
+      ->Option.flatMap(envVarName => NodeProcess.env->Dict.get(envVarName))
       ->Option.filter(queueUrl => queueUrl != "")
       ->Option.map(queueUrl => (name, makePublishJsons(queueUrl)))
     )
@@ -666,7 +665,6 @@ let warnSkippedExtension = (ext: extensionConfig) =>
 type url
 @new external makeUrl: (string, string) => url = "URL"
 @module("node:fs") external readFileSyncUrl: (url, string) => string = "readFileSync"
-@val @scope("process") external cwd: unit => string = "cwd"
 
 // pluginDefinition.json is written at deploy time as a stable JSON literal
 // matching Reventless.Plugin.pluginDefinitionSchema (PluginRuntime_Builder), so
@@ -677,7 +675,7 @@ external asPluginDefinition: JSON.t => Reventless.Plugin.pluginDefinition = "%id
 
 let loadPluginDefinition = (): Reventless.Plugin.pluginDefinition =>
   try {
-    readFileSyncUrl(makeUrl("./pluginDefinition.json", `file://${cwd()}/`), "utf-8")
+    readFileSyncUrl(makeUrl("./pluginDefinition.json", `file://${NodeProcess.cwd()}/`), "utf-8")
     ->JSON.parseOrThrow
     ->asPluginDefinition
   } catch {
@@ -693,7 +691,7 @@ let loadPluginDefinition = (): Reventless.Plugin.pluginDefinition =>
 // both map to None.
 let loadUiFragments = (): option<JSON.t> =>
   try {
-    switch readFileSyncUrl(makeUrl("./uiFragments.json", `file://${cwd()}/`), "utf-8")->JSON.parseOrThrow {
+    switch readFileSyncUrl(makeUrl("./uiFragments.json", `file://${NodeProcess.cwd()}/`), "utf-8")->JSON.parseOrThrow {
     | JSON.Null => None
     | json => Some(json)
     }

package/src/adapter/Runtime/ExtensionPointEntryPoint_Ops.res

@@ -16,7 +16,6 @@
 // records fix the shapes; scheduler/queryEngine still throw by design (not
 // available in the bundled handler).
 
-@val @scope("process") external processEnv: dict<string> = "env"
 
 // ── Shim bindings (HandlerFactoryHelpers.mjs), typed for SQS records ────────
 @module("./HandlerFactoryHelpers.mjs")
@@ -69,7 +68,7 @@ let makeCallbackSpec = (config: handlerConfig): callbackSpec => {
   ->Option.getOr(Dict.make())
   ->Dict.toArray
   ->Array.map(((aggName, envVarName)) => {
-    let queueUrl = processEnv->Dict.get(envVarName)->Option.getOr("")
+    let queueUrl = NodeProcess.env->Dict.get(envVarName)->Option.getOr("")
     let queue: Util_SQS_Runtime.resolvedQueue = {id: queueUrl, name: queueUrl, arn: ""}
     (aggName, queue->CommandTopicChannel_SQS_Runtime.publishJsons(AWS.SQS_FIFO))
   })

package/src/adapter/Runtime/HeartbeatEntryPoint.res

@@ -7,16 +7,15 @@
 // Pulumi value reaches this module's import graph (deploy-time wiring lives in
 // PluginRuntime_Builder.forPluginHeartbeat).
 
-@val @scope("process") external processEnv: dict<string> = "env"
 
 // === Initialize eagerly at module load (Lambda cold start) ===
 
-let epQueueUrl = processEnv->Dict.get("EP_QUEUE_URL")->Option.getOr("")
-let pluginId = processEnv->Dict.get("PLUGIN_ID")->Option.getOr("")
+let epQueueUrl = NodeProcess.env->Dict.get("EP_QUEUE_URL")->Option.getOr("")
+let pluginId = NodeProcess.env->Dict.get("PLUGIN_ID")->Option.getOr("")
 // Mirrors the former shell's `parseInt(…) || 10`: unset, unparsable, and 0 all
 // fall back to the 10-minute default.
 let timeout =
-  processEnv
+  NodeProcess.env
   ->Dict.get("HEARTBEAT_TIMEOUT")
   ->Option.flatMap(s => Int.fromString(s))
   ->Option.filter(n => n != 0)

package/src/adapter/Runtime/PgChangeFeedRelayEntryPoint.res

@@ -23,7 +23,6 @@
 //                 "kind"?: "classic",          // absent → DCB
 //                 "partitionTag"?: <derivedPartitionTag> } ] }  // DCB only
 
-@val @scope("process") external processEnv: dict<string> = "env"
 
 // Structured JSON logging shared by every deployed entry point (HandlerFactoryHelpers).
 type logExtra = {comp?: string}
@@ -89,7 +88,7 @@ let relayLog = async (l: relayLogConfig): unit => {
 
 let handler = async (_event: JSON.t, _context: PulumiAws.Lambda.context) => {
   let config =
-    processEnv->Dict.get("HANDLER_CONFIG")->Option.getOr(`{"logs":[]}`)->parseHandlerConfig
+    NodeProcess.env->Dict.get("HANDLER_CONFIG")->Option.getOr(`{"logs":[]}`)->parseHandlerConfig
   let logs = config.logs->Option.getOr([])
   let _ = await logs->Array.map(relayLog)->Promise.all
   ""

package/src/adapter/Runtime/PgMigrationEntryPoint.res

@@ -18,7 +18,6 @@
 // HANDLER_CONFIG shape:
 //   { "pgConnection": { host, port, database, username, secretArn } }
 
-@val @scope("process") external processEnv: dict<string> = "env"
 
 // Structured JSON logging shared by every deployed entry point (HandlerFactoryHelpers).
 type logExtra = {comp?: string}
@@ -49,6 +48,6 @@ let runMigration = async (
 }
 
 let handler = async (_event: JSON.t, _context: PulumiAws.Lambda.context) => {
-  let config = processEnv->Dict.get("HANDLER_CONFIG")->Option.getOr("{}")->parseHandlerConfig
+  let config = NodeProcess.env->Dict.get("HANDLER_CONFIG")->Option.getOr("{}")->parseHandlerConfig
   await runMigration(config)
 }

package/src/adapter/Runtime/PluginExtensionPointEntryPoint.res

@@ -10,7 +10,6 @@
 // binds the Id module at the ReScript level, mirroring ExtensionPoint_Builder.
 // Runtime-pure: no Pulumi value reaches this module's import graph.
 
-@val @scope("process") external processEnv: dict<string> = "env"
 
 // ── Shim bindings (HandlerFactoryHelpers.mjs) ───────────────────────────────
 // The structured-log + Effect dispatch boundary shared by every deployed entry
@@ -64,7 +63,7 @@ type handlerConfig = {
 
 // === Initialize eagerly at module load (Lambda cold start) ===
 
-let config = processEnv->Dict.get("HANDLER_CONFIG")->Option.getOr("{}")->parseHandlerConfig
+let config = NodeProcess.env->Dict.get("HANDLER_CONFIG")->Option.getOr("{}")->parseHandlerConfig
 
 // Instantiate the Plugin EP mapping. updateApiSchema and manageSubscriptions
 // are admin-only hooks; this Lambda only handles incoming commands (Heartbeat,
@@ -82,7 +81,7 @@ module EpSpec = {
   let runtimeOps: ReventlessCore.PluginRuntimeOperations.operations = {
     messagePublish: {sendMessageToChannel: Util_PluginMessage_Runtime.sendMessage},
   }
-  let environment = processEnv->Dict.get("Environment")->Option.getOr("unknown")
+  let environment = NodeProcess.env->Dict.get("Environment")->Option.getOr("unknown")
   let updateApiSchema: option<Reventless.QueryEngine.operations => promise<unit>> = None
   let manageSubscriptions: option<
     (Reventless.Plugin.pluginDefinition, [#connect | #disconnect]) => promise<unit>,
@@ -108,7 +107,7 @@ let publishToAggregates: dict<ReventlessCore.CommandTopic.publishJsons> =
   ->Option.getOr(Dict.make())
   ->Dict.toArray
   ->Array.map(((aggName, envVarName)) => {
-    let queueUrl = processEnv->Dict.get(envVarName)->Option.getOr("")
+    let queueUrl = NodeProcess.env->Dict.get(envVarName)->Option.getOr("")
     let queue: Util_SQS_Runtime.resolvedQueue = {id: queueUrl, name: queueUrl, arn: ""}
     (aggName, queue->CommandTopicChannel_SQS_Runtime.publishJsons(AWS.SQS_FIFO))
   })

package/src/adapter/Runtime/ProjectionEntryPoint_Ops.res

@@ -16,7 +16,6 @@
 // Runtime-pure: no `open PulumiAws` values — Pulumi appears in type positions
 // only (erased).
 
-@val @scope("process") external processEnv: dict<string> = "env"
 
 // ── Runtime-loaded spec-module reads (typed at the seam) ────────────────────
 // The shells read `config` / `subIdConfig` off dynamically imported spec
@@ -71,8 +70,8 @@ let makeQueryDbOps = (
       ~indexes,
       ~subIdField?,
     )->withLiveUpdates({
-      endpoint: ?(processEnv->Dict.get("APPSYNC_ENDPOINT")),
-      region: ?(processEnv->Dict.get("AWS_REGION")),
+      endpoint: ?(NodeProcess.env->Dict.get("APPSYNC_ENDPOINT")),
+      region: ?(NodeProcess.env->Dict.get("AWS_REGION")),
       topicName: ?stateTopicName,
       subIdField: ?subIdField,
     })

package/src/adapter/Runtime/TaskBucketEntryPoint_Ops.res

@@ -14,7 +14,6 @@
 // ScheduledPublisher_CloudWatchEvents_Runtime directly — the layer ships it —
 // so the mirror is gone.
 
-@val @scope("process") external processEnv: dict<string> = "env"
 @module("./HandlerFactoryHelpers.mjs") @scope("log")
 external logWarn: (string, StreamRoutedEntryPoint_Ops.dispatchOpts) => unit = "warn"
 
@@ -71,7 +70,7 @@ let buildPublishCommands = (map: dict<string>): dict<ReventlessCore.CommandTopic
   map
   ->Dict.toArray
   ->Array.filterMap(((aggName, envVarName)) =>
-    processEnv
+    NodeProcess.env
     ->Dict.get(envVarName)
     ->Option.filter(queueUrl => queueUrl != "")
     ->Option.map(queueUrl => {
@@ -98,9 +97,9 @@ let makeSchedulerOps = (config: option<schedulerEnvConfig>): option<schedulerOps
   | (None, None) => None
   | (None, Some(cfg)) =>
     switch (
-      processEnv->Dict.get(cfg.roleArnEnv),
-      processEnv->Dict.get(cfg.targetArnEnv),
-      processEnv->Dict.get(cfg.targetNameEnv),
+      NodeProcess.env->Dict.get(cfg.roleArnEnv),
+      NodeProcess.env->Dict.get(cfg.targetArnEnv),
+      NodeProcess.env->Dict.get(cfg.targetNameEnv),
     ) {
     | (Some(roleArn), Some(targetArn), Some(targetName))
       if roleArn != "" && targetArn != "" && targetName != "" =>

package/src/adapter/StateTopic/StateTopic_AppSync_Ops.res

@@ -10,13 +10,12 @@
 // are logged and skipped; 5xx / network failures are recorded and rethrown after
 // the batch so the EventSourceMapping retries (bisectBatchOnFunctionError).
 
-@val @scope("process") external processEnv: dict<string> = "env"
 
-let endpoint = processEnv->Dict.get("APPSYNC_ENDPOINT")->Option.getOr("")
+let endpoint = NodeProcess.env->Dict.get("APPSYNC_ENDPOINT")->Option.getOr("")
 
 // STATE_TOPIC_MAP: `{ <tableName>: <topicName> }`, injected at deploy time.
 let topicMap: dict<string> =
-  switch processEnv->Dict.get("STATE_TOPIC_MAP")->Option.getOr("{}")->JSON.parseOrThrow->JSON.Decode.object {
+  switch NodeProcess.env->Dict.get("STATE_TOPIC_MAP")->Option.getOr("{}")->JSON.parseOrThrow->JSON.Decode.object {
   | Some(obj) =>
     obj
     ->Dict.toArray

package/src/adapter/Upload/Upload_Presign_S3_Ops.res

@@ -34,9 +34,6 @@ external getSignedUrl: (s3Client, putObjectCommand, presignOptions) => promise<s
 
 // ── Node bindings (replacing the former `%raw` helpers with typed externals) ──
 
-@val @scope("process") external processEnv: dict<string> = "env"
-
-@module("node:crypto") external randomUUID: unit => string = "randomUUID"
 
 type buffer
 @val @scope("Buffer") external bufferFromBase64: (string, string) => buffer = "from"
@@ -44,7 +41,7 @@ type buffer
 
 // Read an env var, mapping "" / unset to None.
 let getEnv = (k: string): option<string> =>
-  switch processEnv->Dict.get(k) {
+  switch NodeProcess.env->Dict.get(k) {
   | Some("") | None => None
   | Some(v) => Some(v)
   }
@@ -121,7 +118,7 @@ let handler = async (event: functionUrlEvent): response => {
     // served prefix (`SERVED_PREFIX`, e.g. `uploads`) so the CloudFront
     // `{prefix}/*` behavior fronts it. Callers PUT to this exact key.
     let servedPrefix = getEnv("SERVED_PREFIX")->Option.getOr("uploads")
-    let key = `${servedPrefix}/${identityPrefix(event)}${randomUUID()}/${fileName}`
+    let key = `${servedPrefix}/${identityPrefix(event)}${NodeCrypto.randomUUID()}/${fileName}`
     let client = makeS3Client()
     let command = makePutObjectCommand({bucket, key, contentType: ?contentType})
     let uploadUrl = await getSignedUrl(client, command, {expiresIn: 300})

package/src/components/Api/AppSync_Adapter.res

@@ -9,13 +9,8 @@ let log = ReventlessCore.Logger.fromEnv()
 
 // ── SHA-256 helper ─────────────────────────────────────────────────────────
 
-type hashObject
-@module("node:crypto") external createHash: string => hashObject = "createHash"
-@send external hashUpdate: (hashObject, string) => hashObject = "update"
-@send external hashDigest: (hashObject, string) => string = "digest"
-
 let sha256Hex = (input: string): string =>
-  createHash("sha256")->hashUpdate(input)->hashDigest("hex")
+  NodeCrypto.createHash("sha256")->NodeCrypto.hashUpdate(input)->NodeCrypto.hashDigest("hex")
 
 // ── Inline AppSync SDK binding ─────────────────────────────────────────────